1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
# include "bool.h"
void g(int *y);
/*@truenull@*/ bool ptrpred (/*@out@*/ /*@null@*/ int *x)
{
return (x == NULL);
}
/*@only@*/ int *f(/*@null@*/ int *x1, /*@null@*/ int *x2,
/*@null@*/ int *x3, /*@null@*/ int *x4)
{
bool test;
test = x1 && (*x1 == 3); /* okay */
test = !x2 && (*x2 == 3); /* 1. Possible dereference of null pointer: *x2 */
test = x3 || (*x3 == 3); /* 2. Possible dereference of null pointer: *x3 */
test = !x4 || (*x4 == 3); /* okay */
test = ptrpred(x1) && (*x1 == 3); /* 3. Possible dereference of null pointer: *x1 */
test = !ptrpred(x1) && (*x1 == 3); /* okay */
if (x4 && (*x4 == 3))
{
*x4 = 6; /* okay */
}
if (!x4 || (*x4 == 6))
{
*x4 = 12; /* 4. Possible dereference of null pointer: *x4 */
}
if (!x1 || (*x1 == 6))
{
return (x3); /* 5, 6. Unqualified storage returned as only: (x3),
Possibly null storage returned as non-null: (x3) */
}
return (x1); /* 7. Unqualified storage returned as only: (x1)
not: null as non-null (because of || semantics) */
}
|
